Add-In Express VCL And ESET Antivirus Outlook add-in's

Add-in Express™ Support Service
That's what is more important than anything else

Add-In Express VCL And ESET Antivirus Outlook add-in's
Existing Outlook add-in now throws exceptions when ESET anti-virus latest update is installed. 
Subscribe
Dave O'Brien




Posts: 44
Joined: 2019-09-02
With the latest ESET antivirus update with the ESET Outlook add-in, our Outlook add-in (which has been working fine for many years) is now throwing exceptions.

Opening Outlook (Debugging our add-in), waiting for Outlook to settle down then immediately closing it causes:

Project OUTLOOK.EXE raised exception class $C0000005 with message 'access violation at 0x1f7c3aa6: write of address 0x67db91d5'.

This occurs in adxAddIn.pas, TadxCOMAddInModule.Destroy, at line 11264:
if Assigned(FAccessTimer) then FreeAndNil(FAccessTimer);

I can't step any further into this, it ends up in ThreadHookProc which cycles 3 times then blows up with the above error.

Any idea what could be causing this? Is it possible the ESET Outlook add-in is also using Add-In Express components and these are getting mixed up somehow?

I queried ESET (through an intermediate) and they said that "according to the analysis from our developer, this crash is explicit bug in [our add-in] (this plugin try to (wrongly) modify memory which contains our code/function)"
Posted 21 Aug, 2022 21:03:44 Top
Andrei Smolin


Add-in Express team


Posts: 18661
Joined: 2006-05-11
Hello Dave,

We have ESET installed on our machines and we've never got such situations with . I suggest that you check if an empty Add-in Express project with Add-in Express components mimicking the UI of you real add-in produces this issue.

Regards from Poland (CEST),

Andrei Smolin
Add-in Express Team Leader
Posted 23 Aug, 2022 07:47:44 Top
Dave O'Brien




Posts: 44
Joined: 2019-09-02
Can you tell me what version of ESET you have installed. This only occurs with the latest version, previous versions are fine.

The version we have a problem with is ESET Endpoint Security 9.1.2057.0.
Posted 23 Aug, 2022 15:28:56 Top
Dave O'Brien




Posts: 44
Joined: 2019-09-02
Created a test add-in.


library OutlookTest;

uses
  ComServ,
  OutlookTest_TLB in 'OutlookTest_TLB.pas',
  OutlookTest_IMPL in 'OutlookTest_IMPL.pas' {AddInModule: TAddInModule} {cc_OutlookTest: CoClass};

exports
  DllGetClassObject,
  DllCanUnloadNow,
  DllRegisterServer,
  DllUnregisterServer;

{$R *.TLB}

{$R *.RES}

begin
end.

unit OutlookTest_TLB;

{$TYPEDADDRESS OFF}

interface

const
  OutlookTestMajorVersion = 1;
  OutlookTestMinorVersion = 0;

  LIBID_OutlookTest: TGUID = '{B6ED5D65-02F3-4168-8B98-7DAB8BCCBE83}';

  IID_Icc_OutlookTest: TGUID = '{52133F32-D44A-40C7-8BE8-281CC7696D2A}';
  CLASS_cc_OutlookTest: TGUID = '{F6DAE540-F989-45DE-9EAF-62C2EA42E987}';

type
  Icc_OutlookTest = interface(IDispatch)
    ['{52133F32-D44A-40C7-8BE8-281CC7696D2A}']
  end;

  Icc_OutlookTestDisp = dispinterface
    ['{52133F32-D44A-40C7-8BE8-281CC7696D2A}']
  end;

implementation

end.

unit OutlookTest_IMPL;

interface

uses
  ComServ, adxAddIn, OutlookTest_TLB, System.Classes;

type
  Tcc_OutlookTest = class(TadxAddin, Icc_OutlookTest)
  end;

  TAddInModule = class(TadxCOMAddInModule)
  end;

implementation

{$R *.dfm}

{ TAddInModule }

initialization
  TadxFactory.Create(ComServer, Tcc_OutlookTest, CLASS_cc_OutlookTest, TAddInModule);

end.


That's it, no objects apart from the required basics.
This code, in the debugger, throws the access violation as in the previous posts when the ESET Outlook add-in is installed. It doesn't if the ESET add-in is not installed.

Outside of the debugger, i.e. Outlook running on it's own, there is no AV shown, but two application events are logged:

"Add-in execution error. Outlook crashed during the 'Quit' callback of the 'ApplicationEvents' interface while calling into the 'cc_OutlookTest' add-in." and

Faulting application name: OUTLOOK.EXE, version: 16.0.15427.20210, time stamp: 0x62ed493e
Faulting module name: KERNELBASE.dll, version: 10.0.19041.1889, time stamp: 0xdc0d8494
Exception code: 0x0eedfade
Fault offset: 0x0012ca42
Faulting process id: 0x1f88
Faulting application start time: 0x01d8b7497f28ed97
Faulting application path: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
Faulting module path: C:\WINDOWS\System32\KERNELBASE.dll
Report Id: 1f0cfab3-e2ca-409e-a855-864af5cf50a4
Faulting package full name:
Faulting package-relative application ID:

I have not tried this with 64bit Outlook.
It would be nice to know if this isn't just me...
Posted 23 Aug, 2022 18:58:44 Top
Andrei Smolin


Add-in Express team


Posts: 18661
Joined: 2006-05-11
Hello Dave,

I've sent you an email with a download link to a test project.

Regards from Poland (CEST),

Andrei Smolin
Add-in Express Team Leader
Posted 25 Aug, 2022 10:23:09 Top
Dave O'Brien




Posts: 44
Joined: 2019-09-02
This project also fails when the ESET add-in is enabled on Outlook closing.

In this instance it breaks in system.classes.

{ Free an object instance }

procedure FreeObjectInstance(ObjectInstance: Pointer);
begin
  if ObjectInstance <> nil then
  begin
    PObjectInstance(ObjectInstance)^.Next := InstFreeList; <--- Fails here.
    InstFreeList := ObjectInstance;
  end;
end;


Exception Class $C0000005 Access violation at 0x02afeeac: read of address 0x02afeeac.
At this stage I have to do a program reset. The error recurs.

The line of code in addin1_impl is:

destructor TtestCOMAddInModule.Destroy;
begin
  FreeHostApplication;

  if Assigned(FAccessTimer) then FreeAndNil(FAccessTimer); <--- Here

  FCOMAddInClassInstance := nil;
  FCOMAddInClassFactory := nil;

  inherited Destroy;
end;
Posted 25 Aug, 2022 17:38:10 Top
Andrei Smolin


Add-in Express team


Posts: 18661
Joined: 2006-05-11
Hello Dave,

Let's try creating and destroying a timer and an object (together and separately) in TtestCOMAddInModule.CreateNew:

constructor TtestCOMAddInModule.CreateNew(AOwner: TComponent; Dummy: Integer = 0);
var
  obj: TObject;
begin
  inherited CreateNew(AOwner, Dummy);
  // #1
  FAccessTimer := TTimer.Create(nil);
  FreeAndNil(FAccessTimer);
  // #2
  obj := TObject.Create();
  FreeAndNil(obj);


 FAccessTimer := TTimer.Create(nil);
  FAccessTimer.Enabled := False;
  FAccessTimer.Interval := 250;
  FAccessTimer.OnTimer := DoAccessTick;
end;


If the issue replicates itself, we suggest getting rid of TtestCOMAddInModule and creating the timer and/or object in OnConnection. If the issue shows itself in this case, too, we will have a project for the ESET team.

Regards from Poland (CEST),

Andrei Smolin
Add-in Express Team Leader
Posted 26 Aug, 2022 04:13:33 Top
Dave O'Brien




Posts: 44
Joined: 2019-09-02
Instances #1 and #2 do not cause any trouble.
I also tried moving FAccessTimer out of public and into implementation, this made no difference, still bombs on freeing.

I modified Destroy to disable the timer, which works, so it appears it is still a valid object at that stage, the FreeandNil still bombs.

destructor TtestCOMAddInModule.Destroy;
begin
  FreeHostApplication;

  FAccessTimer.Enabled := False; // This is fine
  if Assigned(FAccessTimer) then FreeAndNil(FAccessTimer); // This still bombs out
????


Moving the creation and destruction code into OnConnection and OnDisconnection also makes no difference: Still bombs.
Turning off the ESET Outlook Add-in, everything works with no exceptions in all cases.

The Address of FAccessTimer remains the same from creation to destruction.
Posted 28 Aug, 2022 17:12:52 Top
Andrei Smolin


Add-in Express team


Posts: 18661
Joined: 2006-05-11
Hello Dave,

We don't know how to help you. You can contact the ESET support with that code. As you can see, it is valid and transparent.

Regards from Poland (CEST),

Andrei Smolin
Add-in Express Team Leader
Posted 29 Aug, 2022 16:22:22 Top
Dave O'Brien




Posts: 44
Joined: 2019-09-02
Thanks for your help. I have passed the project on to ESET with explanations, hopefully their programmers can come up with something.
I will let you know what they reply.
Posted 30 Aug, 2022 16:13:17 Top